djvu | 9cea3ad8914836b158f4a3494c1b3b3dadc93af4d9a560cbec22742302de5439

Analysis

max time kernel
143s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25-06-2024 09:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9cea3ad8914836b158f4a3494c1b3b3dadc93af4d9a560cbec22742302de5439.exe
Size

839KB
MD5

71b44c9a55f3b40681f6a5524ca9821d
SHA1

a7b8eb80f4fd81445515b68aa7cf7f4fec4a0295
SHA256

9cea3ad8914836b158f4a3494c1b3b3dadc93af4d9a560cbec22742302de5439
SHA512

a9568bc534c404bd9f13e52e86f4c23158e4cb117c31c25c26db3bad609148251e902f8f2c6d0b0ab3daebd988ae2eba305feeb1a9fc94bc0f44ea4712606492
SSDEEP

12288:oFLV3SQMC2KjSnCs/urQO4VivUI6q9ulGvxnrgJMKut3KENjEhQEOuV:iSQaCsgUI6grzt3K4EWlu

Score

10^/10

djvu discovery persistence ransomware

Malware Config

Extracted

Family

djvu

http://cajgtus.com/test2/get.php

Attributes

extension
.waqa
offline_id
Lc3VTezPWbMhuVAQFzJUdeA68PwI7UDpc5aKHYt1
payload_url
http://defgyma.com/dl/build2.exe
http://cajgtus.com/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. Do not ask assistants from youtube and recovery data sites for help in recovering your data. They can use your free decryption quota and scam you. Our contact is emails in this text document only. You can get and look video overview decrypt tool: https://wetransfer.com/downloads/abe121434ad837dd5bdd03878a14485820240531135509/34284d Price of private key and decrypt software is $999. Discount 50% available if you contact us first 72 hours, that's price for you is $499. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0875PsawqS

rsa_pubkey.plain

Signatures

Detected Djvu ransomware 13 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2884-2-0x0000000004020000-0x000000000413B000-memory.dmp	family_djvu
behavioral1/memory/2968-5-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2968-8-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2968-9-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2968-49-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2524-53-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2524-71-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2524-72-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2524-73-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2524-76-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2524-79-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2524-78-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2524-80-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu

Djvu Ransomware
Ransomware which is a variant of the STOP family.
ransomware djvu
Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

2612 icacls.exe

pid	process
2612	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

9cea3ad8914836b158f4a3494c1b3b3dadc93af4d9a560cbec22742302de5439.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\d639ded6-ab49-47e8-90c3-1ec118c8eccd\\9cea3ad8914836b158f4a3494c1b3b3dadc93af4d9a560cbec22742302de5439.exe\" --AutoStart"	9cea3ad8914836b158f4a3494c1b3b3dadc93af4d9a560cbec22742302de5439.exe

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

3 api.2ip.ua
4 api.2ip.ua
16 api.2ip.ua

flow	ioc
3	api.2ip.ua
4	api.2ip.ua
16	api.2ip.ua

Suspicious use of SetThreadContext 2 IoCs

Processes:

9cea3ad8914836b158f4a3494c1b3b3dadc93af4d9a560cbec22742302de5439.exe9cea3ad8914836b158f4a3494c1b3b3dadc93af4d9a560cbec22742302de5439.exe

description	pid	process	target process
PID 2884 set thread context of 2968	2884	9cea3ad8914836b158f4a3494c1b3b3dadc93af4d9a560cbec22742302de5439.exe	9cea3ad8914836b158f4a3494c1b3b3dadc93af4d9a560cbec22742302de5439.exe
PID 2520 set thread context of 2524	2520	9cea3ad8914836b158f4a3494c1b3b3dadc93af4d9a560cbec22742302de5439.exe	9cea3ad8914836b158f4a3494c1b3b3dadc93af4d9a560cbec22742302de5439.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

9cea3ad8914836b158f4a3494c1b3b3dadc93af4d9a560cbec22742302de5439.exe9cea3ad8914836b158f4a3494c1b3b3dadc93af4d9a560cbec22742302de5439.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C	9cea3ad8914836b158f4a3494c1b3b3dadc93af4d9a560cbec22742302de5439.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0400000001000000100000003e455215095192e1b75d379fb187298a0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802025300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c00b000000010000001600000047006c006f00620061006c005300690067006e000000140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c190000000100000010000000a823b4a20180beb460cab955c24d7e21200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	9cea3ad8914836b158f4a3494c1b3b3dadc93af4d9a560cbec22742302de5439.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C	9cea3ad8914836b158f4a3494c1b3b3dadc93af4d9a560cbec22742302de5439.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802025300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c00b000000010000001600000047006c006f00620061006c005300690067006e000000140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	9cea3ad8914836b158f4a3494c1b3b3dadc93af4d9a560cbec22742302de5439.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b0b000000010000001600000047006c006f00620061006c005300690067006e0000005300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802020f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	9cea3ad8914836b158f4a3494c1b3b3dadc93af4d9a560cbec22742302de5439.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

9cea3ad8914836b158f4a3494c1b3b3dadc93af4d9a560cbec22742302de5439.exe9cea3ad8914836b158f4a3494c1b3b3dadc93af4d9a560cbec22742302de5439.exe

pid	process
2968	9cea3ad8914836b158f4a3494c1b3b3dadc93af4d9a560cbec22742302de5439.exe
2968	9cea3ad8914836b158f4a3494c1b3b3dadc93af4d9a560cbec22742302de5439.exe
2524	9cea3ad8914836b158f4a3494c1b3b3dadc93af4d9a560cbec22742302de5439.exe
2524	9cea3ad8914836b158f4a3494c1b3b3dadc93af4d9a560cbec22742302de5439.exe

Suspicious use of WriteProcessMemory 30 IoCs

Processes:

9cea3ad8914836b158f4a3494c1b3b3dadc93af4d9a560cbec22742302de5439.exe9cea3ad8914836b158f4a3494c1b3b3dadc93af4d9a560cbec22742302de5439.exe9cea3ad8914836b158f4a3494c1b3b3dadc93af4d9a560cbec22742302de5439.exe

C:\Users\Admin\AppData\Local\Temp\9cea3ad8914836b158f4a3494c1b3b3dadc93af4d9a560cbec22742302de5439.exe
"C:\Users\Admin\AppData\Local\Temp\9cea3ad8914836b158f4a3494c1b3b3dadc93af4d9a560cbec22742302de5439.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2884

C:\Users\Admin\AppData\Local\Temp\9cea3ad8914836b158f4a3494c1b3b3dadc93af4d9a560cbec22742302de5439.exe
"C:\Users\Admin\AppData\Local\Temp\9cea3ad8914836b158f4a3494c1b3b3dadc93af4d9a560cbec22742302de5439.exe"
2⤵
- Adds Run key to start application
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2968

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Users\Admin\AppData\Local\d639ded6-ab49-47e8-90c3-1ec118c8eccd" /deny *S-1-1-0:(OI)(CI)(DE,DC)
3⤵
- Modifies file permissions
PID:2612

C:\Users\Admin\AppData\Local\Temp\9cea3ad8914836b158f4a3494c1b3b3dadc93af4d9a560cbec22742302de5439.exe
"C:\Users\Admin\AppData\Local\Temp\9cea3ad8914836b158f4a3494c1b3b3dadc93af4d9a560cbec22742302de5439.exe" --Admin IsNotAutoStart IsNotTask
3⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2520

C:\Users\Admin\AppData\Local\Temp\9cea3ad8914836b158f4a3494c1b3b3dadc93af4d9a560cbec22742302de5439.exe
"C:\Users\Admin\AppData\Local\Temp\9cea3ad8914836b158f4a3494c1b3b3dadc93af4d9a560cbec22742302de5439.exe" --Admin IsNotAutoStart IsNotTask
4⤵
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
PID:2524

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Filesize
1KB

MD5
2365869258df7a66a2121b802ca4afd9

SHA1
73acc30a2edeb9d6830de559bb8a74f35168135d

SHA256
d6b1932822bbd72a8e78c771717d992142348f67d625a42393719fefbe59b0ed

SHA512
795004bab536e128dbd81c188976d37c7b650efbfa5a80374df4c65a1049c27658f4620b7605583928eb167fcb69b4c99e4c8730c507b824a7bde9c7fb0e21f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
Filesize
436B

MD5
1bfe0a81db078ea084ff82fe545176fe

SHA1
50b116f578bd272922fa8eae94f7b02fd3b88384

SHA256
5ba8817f13eee00e75158bad93076ab474a068c6b52686579e0f728fda68499f

SHA512
37c582f3f09f8d80529608c09041295d1644bcc9de6fb8c4669b05339b0dd870f9525abc5eed53ad06a94b51441275504bc943c336c5beb63b53460ba836ca8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Filesize
174B

MD5
6167dab6025cfc2a70fc1c97add5e46d

SHA1
2513c02e0138b693f76cd0a00064dfc9f765ca2c

SHA256
1765421f619ba3cadab211d499f270f91ff9d5c7d0fc9cdea7e68408d3e2dab8

SHA512
135f6637a07400775faebb98ad9d8d86144ed3b1ff863fec67425a6cc056629f0795abe5a3acb93e35103216d682b1db41c91ee359781a51dcb4637360efcb91

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
7e627229c621612d64b74140b8694266

SHA1
d1f3a839f790f2ba8995ac99d807b3e859018a1b

SHA256
fa71da7d27a8869bd8d751e7e3b3d8990d4ad6b6bfd3c13a47a029186bee98c8

SHA512
29b7c52d9004efd3f8f56500fec887853cb54c9ccd8648cd3351c850ee9d3ba2e7ebe78489967d0097c60d8c3e7f2a25a58e2fa77e4acc0aec751bd813ba6983

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
Filesize
170B

MD5
b2add703ed764a8ed156bba0b0b4d88a

SHA1
474e7c442fd29dc06b787dd0ed09c434c791f1da

SHA256
f429b2c1cb75b61f69dd7557ee2ffea296aa3e429ea605189eba75bfb81db08a

SHA512
56ce7be89ac3dd8bb7786351e078f99052b1f41457764afede05e58c190b80ed13cd4a8577dc1078a654ed9075ce0670239c2ea53402ee9ebbdd408810e38955

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize
242B

MD5
d03876d84ae3cc39944e89e942f353c7

SHA1
9faadcc0b984c1f51e0c1759e926c5fb6d7d748f

SHA256
4bc2f0c06c0f1563a2acce55cb9185e13d42c1f570d8b5432f1a520520accfae

SHA512
91933aecd87cfb5fed0acb6400bb6491c48cd46eb5668509726b078e5398936e811f633ef9814fe9942854761ecaba1af3519834c55dbcf6c2a2826539845640

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar17A7.tmp
Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\d639ded6-ab49-47e8-90c3-1ec118c8eccd\9cea3ad8914836b158f4a3494c1b3b3dadc93af4d9a560cbec22742302de5439.exe
Filesize
839KB

MD5
71b44c9a55f3b40681f6a5524ca9821d

SHA1
a7b8eb80f4fd81445515b68aa7cf7f4fec4a0295

SHA256
9cea3ad8914836b158f4a3494c1b3b3dadc93af4d9a560cbec22742302de5439

SHA512
a9568bc534c404bd9f13e52e86f4c23158e4cb117c31c25c26db3bad609148251e902f8f2c6d0b0ab3daebd988ae2eba305feeb1a9fc94bc0f44ea4712606492

Download Submit
memory/2520-50-0x0000000000330000-0x00000000003C1000-memory.dmp

Filesize
580KB

Download
memory/2524-71-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2524-72-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2524-80-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2524-78-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2524-79-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2524-53-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2524-76-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2524-73-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2884-7-0x0000000000220000-0x00000000002B1000-memory.dmp

Filesize
580KB

Download
memory/2884-1-0x0000000000220000-0x00000000002B1000-memory.dmp

Filesize
580KB

Download
memory/2884-0-0x0000000000220000-0x00000000002B1000-memory.dmp

Filesize
580KB

Download
memory/2884-2-0x0000000004020000-0x000000000413B000-memory.dmp

Filesize
1.1MB

Download
memory/2968-5-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2968-8-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2968-9-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2968-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2968-49-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download

description	pid	process	target process
PID 2884 wrote to memory of 2968	2884	9cea3ad8914836b158f4a3494c1b3b3dadc93af4d9a560cbec22742302de5439.exe	9cea3ad8914836b158f4a3494c1b3b3dadc93af4d9a560cbec22742302de5439.exe
PID 2884 wrote to memory of 2968	2884	9cea3ad8914836b158f4a3494c1b3b3dadc93af4d9a560cbec22742302de5439.exe	9cea3ad8914836b158f4a3494c1b3b3dadc93af4d9a560cbec22742302de5439.exe
PID 2884 wrote to memory of 2968	2884	9cea3ad8914836b158f4a3494c1b3b3dadc93af4d9a560cbec22742302de5439.exe	9cea3ad8914836b158f4a3494c1b3b3dadc93af4d9a560cbec22742302de5439.exe
PID 2884 wrote to memory of 2968	2884	9cea3ad8914836b158f4a3494c1b3b3dadc93af4d9a560cbec22742302de5439.exe	9cea3ad8914836b158f4a3494c1b3b3dadc93af4d9a560cbec22742302de5439.exe
PID 2884 wrote to memory of 2968	2884	9cea3ad8914836b158f4a3494c1b3b3dadc93af4d9a560cbec22742302de5439.exe	9cea3ad8914836b158f4a3494c1b3b3dadc93af4d9a560cbec22742302de5439.exe
PID 2884 wrote to memory of 2968	2884	9cea3ad8914836b158f4a3494c1b3b3dadc93af4d9a560cbec22742302de5439.exe	9cea3ad8914836b158f4a3494c1b3b3dadc93af4d9a560cbec22742302de5439.exe
PID 2884 wrote to memory of 2968	2884	9cea3ad8914836b158f4a3494c1b3b3dadc93af4d9a560cbec22742302de5439.exe	9cea3ad8914836b158f4a3494c1b3b3dadc93af4d9a560cbec22742302de5439.exe
PID 2884 wrote to memory of 2968	2884	9cea3ad8914836b158f4a3494c1b3b3dadc93af4d9a560cbec22742302de5439.exe	9cea3ad8914836b158f4a3494c1b3b3dadc93af4d9a560cbec22742302de5439.exe
PID 2884 wrote to memory of 2968	2884	9cea3ad8914836b158f4a3494c1b3b3dadc93af4d9a560cbec22742302de5439.exe	9cea3ad8914836b158f4a3494c1b3b3dadc93af4d9a560cbec22742302de5439.exe
PID 2884 wrote to memory of 2968	2884	9cea3ad8914836b158f4a3494c1b3b3dadc93af4d9a560cbec22742302de5439.exe	9cea3ad8914836b158f4a3494c1b3b3dadc93af4d9a560cbec22742302de5439.exe
PID 2884 wrote to memory of 2968	2884	9cea3ad8914836b158f4a3494c1b3b3dadc93af4d9a560cbec22742302de5439.exe	9cea3ad8914836b158f4a3494c1b3b3dadc93af4d9a560cbec22742302de5439.exe
PID 2968 wrote to memory of 2612	2968	9cea3ad8914836b158f4a3494c1b3b3dadc93af4d9a560cbec22742302de5439.exe	icacls.exe
PID 2968 wrote to memory of 2612	2968	9cea3ad8914836b158f4a3494c1b3b3dadc93af4d9a560cbec22742302de5439.exe	icacls.exe
PID 2968 wrote to memory of 2612	2968	9cea3ad8914836b158f4a3494c1b3b3dadc93af4d9a560cbec22742302de5439.exe	icacls.exe
PID 2968 wrote to memory of 2612	2968	9cea3ad8914836b158f4a3494c1b3b3dadc93af4d9a560cbec22742302de5439.exe	icacls.exe
PID 2968 wrote to memory of 2520	2968	9cea3ad8914836b158f4a3494c1b3b3dadc93af4d9a560cbec22742302de5439.exe	9cea3ad8914836b158f4a3494c1b3b3dadc93af4d9a560cbec22742302de5439.exe
PID 2968 wrote to memory of 2520	2968	9cea3ad8914836b158f4a3494c1b3b3dadc93af4d9a560cbec22742302de5439.exe	9cea3ad8914836b158f4a3494c1b3b3dadc93af4d9a560cbec22742302de5439.exe
PID 2968 wrote to memory of 2520	2968	9cea3ad8914836b158f4a3494c1b3b3dadc93af4d9a560cbec22742302de5439.exe	9cea3ad8914836b158f4a3494c1b3b3dadc93af4d9a560cbec22742302de5439.exe
PID 2968 wrote to memory of 2520	2968	9cea3ad8914836b158f4a3494c1b3b3dadc93af4d9a560cbec22742302de5439.exe	9cea3ad8914836b158f4a3494c1b3b3dadc93af4d9a560cbec22742302de5439.exe
PID 2520 wrote to memory of 2524	2520	9cea3ad8914836b158f4a3494c1b3b3dadc93af4d9a560cbec22742302de5439.exe	9cea3ad8914836b158f4a3494c1b3b3dadc93af4d9a560cbec22742302de5439.exe
PID 2520 wrote to memory of 2524	2520	9cea3ad8914836b158f4a3494c1b3b3dadc93af4d9a560cbec22742302de5439.exe	9cea3ad8914836b158f4a3494c1b3b3dadc93af4d9a560cbec22742302de5439.exe
PID 2520 wrote to memory of 2524	2520	9cea3ad8914836b158f4a3494c1b3b3dadc93af4d9a560cbec22742302de5439.exe	9cea3ad8914836b158f4a3494c1b3b3dadc93af4d9a560cbec22742302de5439.exe
PID 2520 wrote to memory of 2524	2520	9cea3ad8914836b158f4a3494c1b3b3dadc93af4d9a560cbec22742302de5439.exe	9cea3ad8914836b158f4a3494c1b3b3dadc93af4d9a560cbec22742302de5439.exe
PID 2520 wrote to memory of 2524	2520	9cea3ad8914836b158f4a3494c1b3b3dadc93af4d9a560cbec22742302de5439.exe	9cea3ad8914836b158f4a3494c1b3b3dadc93af4d9a560cbec22742302de5439.exe
PID 2520 wrote to memory of 2524	2520	9cea3ad8914836b158f4a3494c1b3b3dadc93af4d9a560cbec22742302de5439.exe	9cea3ad8914836b158f4a3494c1b3b3dadc93af4d9a560cbec22742302de5439.exe
PID 2520 wrote to memory of 2524	2520	9cea3ad8914836b158f4a3494c1b3b3dadc93af4d9a560cbec22742302de5439.exe	9cea3ad8914836b158f4a3494c1b3b3dadc93af4d9a560cbec22742302de5439.exe
PID 2520 wrote to memory of 2524	2520	9cea3ad8914836b158f4a3494c1b3b3dadc93af4d9a560cbec22742302de5439.exe	9cea3ad8914836b158f4a3494c1b3b3dadc93af4d9a560cbec22742302de5439.exe
PID 2520 wrote to memory of 2524	2520	9cea3ad8914836b158f4a3494c1b3b3dadc93af4d9a560cbec22742302de5439.exe	9cea3ad8914836b158f4a3494c1b3b3dadc93af4d9a560cbec22742302de5439.exe
PID 2520 wrote to memory of 2524	2520	9cea3ad8914836b158f4a3494c1b3b3dadc93af4d9a560cbec22742302de5439.exe	9cea3ad8914836b158f4a3494c1b3b3dadc93af4d9a560cbec22742302de5439.exe
PID 2520 wrote to memory of 2524	2520	9cea3ad8914836b158f4a3494c1b3b3dadc93af4d9a560cbec22742302de5439.exe	9cea3ad8914836b158f4a3494c1b3b3dadc93af4d9a560cbec22742302de5439.exe